Awsclaw Iam

Awsclaw IAM

Manage and inspect IAM roles, policies, users, groups, simulate permissions, and audit credentials.

When to Use This Skill

Use this skill when the user:

• Asks about IAM roles, policies, or permissions
• Wants to inspect what a role or user can access
• Needs to simulate permissions with SimulatePrincipalPolicy
• Wants to audit users, access keys, MFA devices
• Asks about credential reports or account settings
• Needs to check attached or inline policies
• Wants to create, update, or delete IAM roles, users, groups, or policies
• Needs to attach or detach policies and manage tags

Tool: IAMTool

Execute AWS IAM commands including permission simulation and lifecycle management. ALWAYS provide params object.

Commands

ListRoles

List IAM roles.

{ "command": "ListRoles", "params": { "MaxItems": 100 } }

Parameters:

GetRole

Get details of an IAM role.

{ "command": "GetRole", "params": { "RoleName": "my-role" } }

Parameters:

GetRolePolicy

Get an inline policy attached to a role.

{ "command": "GetRolePolicy", "params": { "RoleName": "my-role", "PolicyName": "my-inline-policy" } }

Parameters:

ListRolePolicies

List inline policy names for a role.

{ "command": "ListRolePolicies", "params": { "RoleName": "my-role" } }

Parameters:

ListAttachedRolePolicies

List managed policies attached to a role.

{ "command": "ListAttachedRolePolicies", "params": { "RoleName": "my-role" } }

Parameters:

ListRoleTags

List tags attached to a role.

{ "command": "ListRoleTags", "params": { "RoleName": "my-role" } }

Parameters:

ListPolicies

List IAM policies.

{ "command": "ListPolicies", "params": { "Scope": "Local", "OnlyAttached": true } }

Parameters:

GetPolicy

Get details of a managed policy.

{ "command": "GetPolicy", "params": { "PolicyArn": "arn:aws:iam::123456789012:policy/my-policy" } }

Parameters:

GetPolicyVersion

Get a specific version of a policy document.

{ "command": "GetPolicyVersion", "params": { "PolicyArn": "arn:aws:iam::123456789012:policy/my-policy", "VersionId": "v1" } }

Parameters:

ListPolicyVersions

List all versions of a managed policy.

{ "command": "ListPolicyVersions", "params": { "PolicyArn": "arn:aws:iam::123456789012:policy/my-policy" } }

Parameters:

ListUsers

List IAM users.

{ "command": "ListUsers", "params": {} }

Parameters:

GetUser

Get details of an IAM user.

{ "command": "GetUser", "params": { "UserName": "john" } }

Parameters:

ListAccessKeys

List access keys for a user.

{ "command": "ListAccessKeys", "params": { "UserName": "john" } }

Parameters:

ListMFADevices

List MFA devices for a user.

{ "command": "ListMFADevices", "params": { "UserName": "john" } }

Parameters:

ListGroups

List IAM groups.

{ "command": "ListGroups", "params": {} }

Parameters:

GetAccountSummary

Get IAM account summary (resource counts and limits).

{ "command": "GetAccountSummary", "params": {} }

Parameters: None required.

Lifecycle Commands

CreateRole

Create a new IAM role.

{ "command": "CreateRole", "params": { "RoleName": "MyRole", "AssumeRolePolicyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}" } }

CreateUser

Create a new IAM user.

{ "command": "CreateUser", "params": { "UserName": "alice" } }

AttachRolePolicy

Attach a managed policy to a role.

{ "command": "AttachRolePolicy", "params": { "RoleName": "MyRole", "PolicyArn": "arn:aws:iam::aws:policy/ReadOnlyAccess" } }

PutRolePolicy

Add or update an inline policy on a role.

{ "command": "PutRolePolicy", "params": { "RoleName": "MyRole", "PolicyName": "InlinePolicy", "PolicyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:ListBucket\"],\"Resource\":[\"*\"]}]}" } }

DeleteRole

Delete an IAM role.

{ "command": "DeleteRole", "params": { "RoleName": "MyRole" } }

TagRole

Tag a role.

{ "command": "TagRole", "params": { "RoleName": "MyRole", "Tags": [{ "Key": "env", "Value": "prod" }] } }

UntagRole

Remove tags from a role.

{ "command": "UntagRole", "params": { "RoleName": "MyRole", "TagKeys": ["env"] } }

UpdateAssumeRolePolicy

Update a role trust policy.

{ "command": "UpdateAssumeRolePolicy", "params": { "RoleName": "MyRole", "PolicyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ecs.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}" } }

GetAccountPasswordPolicy

Get the account password policy.

{ "command": "GetAccountPasswordPolicy", "params": {} }

Parameters: None required.

GenerateCredentialReport

Generate a credential report (async — poll with GetCredentialReport).

{ "command": "GenerateCredentialReport", "params": {} }

Parameters: None required.

GetCredentialReport

Get the most recently generated credential report.

{ "command": "GetCredentialReport", "params": {} }

Parameters: None required.

GetServiceLastAccessedDetails

Get last accessed details for services by an IAM entity.

{ "command": "GetServiceLastAccessedDetails", "params": { "JobId": "12345678-1234-1234-1234-123456789012" } }

Parameters:

SimulatePrincipalPolicy

Simulate IAM policy evaluation — test what a role/user can access.

{
  "command": "SimulatePrincipalPolicy",
  "params": {
    "PolicySourceArn": "arn:aws:iam::123456789012:role/MyRole",
    "ActionNames": ["s3:GetObject", "s3:PutObject"],
    "ResourceArns": ["arn:aws:s3:::my-bucket/*"]
  }
}

Parameters:

Related Services

• IAM → All Services: IAM roles and policies control access to every AWS service. Key services using IAM roles:
  • Lambda: Execution roles (check GetFunctionConfiguration → Role)
  • EC2: Instance profiles
  • Glue: Job execution roles
  • Step Functions: State machine execution roles
  • ECS: Task execution roles and task roles
• IAM → STS: Use STSTool GetCallerIdentity to verify current identity, AssumeRole to switch roles
• IAM → CloudTrail → CloudWatch: IAM API calls logged in CloudTrail. Use CloudWatchLogTool to search CloudTrail log groups
• IAM → CloudFormation: IAM resources managed by CloudFormation stacks